Security audit · next

Security audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is a next-action workflow helper, but it uses persistent hooks and broad local/project-state discovery that users should review before installing.

Install only if you want an automated next-action system that can inspect transcripts, task state, GitHub/CI context, and planning files across visited workspaces. Before enabling hooks, verify the hook paths, limit use to trusted workspaces, and be cautious with the helper-script lookup/execution path under agent plugin directories.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (50)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · CHANGELOG.md (reported line 172)May include surrounding context.
md
### Features * **consolidate:** address PR 134 reviews and reflect orange/yellow severity display rules ([e6118d0](https://github.com/es6kr/skills/commit/e6118d0fb0217a4c4ad388b82e574203a8f9258e)) * **hook-kit:** add pre-tool AskUserQuestion context gate ([#123](https://github.com/es6kr/skills/issues/123)) ([271b5b3](https://github.com/es6kr/skills/commit/271b5b37df5e64cf3185b2c81c3d97b66789e9ab)) * **next-feat:** accumulate features for hook-kit context gate ([df4f73a](https://github.com/es6kr/skills/commit/df4f73ae4d27d4919105da70c6c94a14a32e8056)) * **next:** wire Stop auto-invocation via script action + jq portability ([de2bed5](https://github.com/es6kr/skills/commit/de2bed5489a247a21eab54c0e13b27ae00d18196))

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
ckstop, owned by the `next-invocation-guard` plugin (local-only, ported from `resources/next-trigger.sh` + `resources/next-reactive-guard.sh`). Fires when assis

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
ckstop, owned by the `next-invocation-guard` plugin (local-only, ported from `resources/next-trigger.sh` + `resources/next-reactive-guard.sh`). Fires when assis

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
ocation-guard` plugin (local-only, ported from `resources/next-trigger.sh` + `resources/next-reactive-guard.sh`). Fires when assistant response contains complet

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
t priority, TaskList primary-source, current-work confirmation | [ask-gates.md](./ask-gates.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
t priority, TaskList primary-source, current-work confirmation | [ask-gates.md](./ask-gates.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
t priority, TaskList primary-source, current-work confirmation | [ask-gates.md](./ask-gates.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
t priority, TaskList primary-source, current-work confirmation | [ask-gates.md](./ask-gates.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
md
t priority, TaskList primary-source, current-work confirmation | [ask-gates.md](./ask-gates.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
| suggestion-patterns | Per-context "After X" next-action option templates | [suggestion-patterns.md](./suggestion-patterns.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
| suggestion-patterns | Per-context "After X" next-action option templates | [suggestion-patterns.md](./suggestion-patterns.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
| suggestion-patterns | Per-context "After X" next-action option templates | [suggestion-patterns.md](./suggestion-patterns.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
| suggestion-patterns | Per-context "After X" next-action option templates | [suggestion-patterns.md](./suggestion-patterns.md) |

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · resources/next-trigger.sh (reported line 30)May include surrounding context.
sh
# # Responsibility: next skill (per automation.md "Hook responsibility policy"). # Install: copy to ~/.claude/hooks/next-trigger.sh and register in # ~/.claude/settings.json under "Stop" matcher (see next/SKILL.md Install). set -euo pipefail

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 97% confidence
Finding: The instructions explicitly search agent/plugin directories under ~/.claude and execute a discovered script via bash, which is sensitive local configuration access combined with code execution. If a malicious or tampered script is present in those locations, the skill's guidance would cause arbitrary local code execution and expose transcript data.
Content: Scanner excerpt · suggestion-patterns.md (reported line 484)May include surrounding context.
echo '{"transcript_path": ""}' | bash

text
This invokes the injection script directly — it parses the transcript's last assistant-message usage field on demand and does not depend on a fresh `UserPromptSubmit` firing. Use this live number, not the stale injected line, before citing any percentage as gate justification. (**Resolve the script's path, do not assume it.** It ships with the hook-kit skill as `resources/context-usage-inject.sh`, so locate it with e.g. `ls ~/.claude/plugins/marketplaces/*/skills/*/resources/context-usage-inject.sh` rather than hardcoding an install location — note that a plain `find ~/.claude/plugins/marketplaces -name context-usage-inject.sh` returns **nothing** when the marketplace entry is a symlink into a checkout, so it needs `find -L` if you prefer find — `~/.claude/hooks/context-usage-inject.sh` was documented here previously and does **not** exist on at least one install, which turns this whole fallback into a dead end exactly when it is needed. Other environments provide their own equivalent or none at all — absence of a direct-invocation path means fall back to omitting the option per the paragraph above.) | # | Don't | Do | |---|-------|-----|

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The automatic trigger is based on generic 'completion keywords' matched from locale regex files, which is ambiguous and likely to overlap with normal assistant responses. Because this skill can then drive AskUserQuestion flows and secondary task-selection behavior, a false positive trigger can alter the conversation state and pressure the user into actions they did not request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises activation on broad natural-language phrases like 'next action', 'what next', 'stall', 'stuck', and 'not progressing', which are common conversational terms rather than narrowly-scoped commands. In an auto-invoked orchestration environment, this can cause unintended skill activation during ordinary discussion, leading to unwanted workflow branching, extra tool calls, or user-manipulation prompts at the wrong time.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
md
|---|-------------------|------------------------| | 1 | Carry an "still open" item straight from a pre-compact summary into an option label | Re-check its current state (fix_plan Completed / RAG / Plane) before phrasing it as actionable | | 2 | Treat "it was in_progress when the summary was written" as proof it still is | in_progress in a stale summary is a snapshot, not current truth — verify, don't assume | | 3 | Skip verification because the investigation "sounds involved" | The verification itself (grep fix_plan, one RAG query, one Plane check) is cheaper than dispatching the user into a re-investigation of an already-solved problem | | 4 | Compose a decision ask from a fix_plan item's inline "Why"/summary text alone, when that item's "How to apply" points at a linked plan doc | Read the linked doc's own Progress Checklist / phase-completion state first — fix_plan's inline note can go stale relative to the doc's own tracked progress (e.g. a phase the fix_plan note calls undecided may already show complete in the plan doc) | | 5 | Treat a plan doc's own recorded "decision" (a numbered decision table, a "Decisions" section) as user-authorized just because it reads as settled | The doc's formatting doesn't distinguish a decision the user actually made (via an `AskUserQuestion` answer, an explicit chat instruction) from scope the assistant added while authoring the plan solo. Before resuming such a decision from a prior session, re-derive the original user ask (RAG search / session transcript), not the plan doc's own summary of it |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: L061 requires treating '/cleanup, or its session-language equivalent' as a cleanup selection trigger. While multilingual support can be appropriate, the file does not indicate user choice or opt-in for locale handling, creating a potential language/locale policy issue under the stated rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Line L105 explicitly requires handling 'locale equivalents' in the session language for decision-deferral phrases. This imposes language/locale-specific behavior as a rule without stating that the user can choose or opt into a language/locale preference.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The persistence fallback directs the agent to inspect session history, enumerate all workspace roots visited, and read persistent planning files from each, including non-current repositories and alternate hidden state directories. That expands retention and retrieval scope beyond the active task, increasing the risk of cross-project data leakage and unintended use of stale sensitive context.
Content: Scanner excerpt · ask-gates.md (reported line 210)May include surrounding context.
md
## Step 0.6: Workspace fix_plan.md active integration protocol (MANDATORY — when TaskList is empty, done, or unavailable) **Trigger scope (HARD STOP)**: this step applies whenever `TaskList` yields no actionable pending items — whether because it is genuinely empty, all items are done, **or the TaskList/TaskCreate tool is disconnected/unavailable this turn**. "Unavailable" is not a different case from "empty" — both mean the session-local task medium cannot surface backlog, so the persistent checklist medium (`fix_plan.md`) becomes the primary source. Do not read the word "empty" literally and treat a disconnected tool as exempt. 1. **Locate Workspace Root(s)**: Determine the active workspace root(s) containing `.git`, `.ralph/`, **or Ralph-marker files** (`PROMPT.md` + `AGENT.md` alongside `progress.json` / `status.json` / `.circuit_breaker_state`) — a Ralph-loop-owned workspace is not always a git repo and does not always name its state directory `.ralph/`. **Do not derive this from current cwd alone** — a session can move across multiple workspaces (e.g., start in a project directory debugging an issue, then pivot to a skills/rules repo). Enumerate every workspace root visited during the session (via Bash cwd changes, Read/Edit/Grep paths, or `cd`/`git -C` targets seen in the transcript), not just the one matching the cwd at the moment `next` fires. 2. **Find fix_plan.md**: For each workspace root from step 1, read its project backlog checklist at any of `<workspace-root>/.ralph/fix_plan.md`, `<workspace-root>/fix_plan.md`, or `<workspace-root>/.agents/fix_plan.md` if present. The third pattern is a **workspace-LOCAL** `.agents/` state directory (some Ralph workspaces name their loop directory `.agents/` instead of `.ralph/`) — this is a different thing from the global `~/.agents` skills/rules repo; do not skip it because `.agents` "already means the global skills repo" in this session. A workspace without any of the three is skipped, not treated as proof no ot ...[truncated 24 chars]

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: This section instructs the agent to mine visited workspace roots and persistent backlog files across the session, including multiple repositories and alternate state directories. In a security context, that broadens data discovery beyond the immediate task and can cause cross-workspace information exposure or unintended action suggestions based on unrelated private project state.
Content: Scanner excerpt · ask-gates.md (reported line 225)May include surrounding context.
md
| # | Don't | Do | |---|---|---| | 1 | Suggest "End session" immediately when session tasks are complete without checking the project's persistent backlog | Read the active workspace's `fix_plan.md` first, find prioritized tasks, and offer them | | 2 | Pull tasks from a parent or different workspace's `fix_plan.md` | Detect the current workspace root(s) first, then read the local `.ralph/fix_plan.md` for each one actually visited this session | | 3 | Present tasks out of priority order (e.g. suggesting P2/REPEAT before P0/P1) | Sort strictly by priority level (`P0` -> `P1` -> `P2` -> `[REPEAT]`) and surface the highest first | | 4 | Present all `fix_plan.md` tasks blindly | Filter for tasks that are relevant to the files or topics touched in the current session first |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · ask-gates.md (reported line 339)May include surrounding context.
md
|--------|---------|-----------------| | 2+ in_progress tasks in TaskList | {server-A} migration + {app-import} + ansible inspection all in_progress | Ask the user which is actually being worked on | | User's prior message ambiguous about scope | "finishing ssh fix and design change" (which server? which design change?) | Ask the user to pinpoint scope | | Task description includes "user direct work" / "user execution wait" | {server-A} sudo wait, manual server work | Ask the user "is the work done? in progress? not started?" | | Stop hook auto-invoked next (not single task completion) | Multi-task session, partial completion | Ask the user "which work was completed? what to do next?" | ### Don't / Do table

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · ask-gates.md (reported line 355)May include surrounding context.
md
|--------|---------|-----------------| | 2+ in_progress tasks in TaskList | {server-A} migration + {app-import} + ansible inspection all in_progress | Ask the user which is actually being worked on | | User's prior message ambiguous about scope | "finishing ssh fix and design change" (which server? which design change?) | Ask the user to pinpoint scope | | Task description includes "user direct work" / "user execution wait" | {server-A} sudo wait, manual server work | Ask the user "is the work done? in progress? not started?" | | Stop hook auto-invoked next (not single task completion) | Multi-task session, partial completion | Ask the user "which work was completed? what to do next?" | ### Don't / Do table

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · ask-gates.md (reported line 364)May include surrounding context.
md
| Concept | Meaning | How to ask | |---------|---------|------------| | in progress | Work the user is actively performing (running a sudo command, working in the IDE, etc.) | "What are you working on right now?" | | **waiting on** | Something the user is awaiting an external response/result for (CI result, teammate response, build finish, etc.) | **"What result are you waiting on?"** — must be asked as a separate question | **Do not combine the two in a single option.** Example: "{server-A} sudo in progress" is in-progress, while "{server-B} 502 recovery waiting" is waiting-on. Mixing them in one option set makes the answer ambiguous.

Static analysis

No suspicious patterns detected.